1

My iPhone 7 iOS 10.3.1 randomly started receiving untrusted certificate pop-ups from onboard.info (but I’ve seen it on devices going back to iPhone 5):

This was at home last night and I had just unlocked my phone. I tried to get a screenshot of the rest of the certificate details but it was registered as just a home button press and there is no way to switch back into the certificate warning dialogue by changing apps.

I can’t apply any logic to the root cause of this or recreate it. I’ve never clicked Trust for obvious reasons.

Can anyone explain?

21/04/17 - Just happened again. The irony of the backdrop in this picture is not lost on me. Is this some sort of MITM attack?

cert warning

Improve this question

1 Answer 1

Reset to default
1

Yes, it seems to be a MITM attack. The pcr.apple.com has a certificate issued by Symantec for Apple - but you're getting an entirely different, self-signed certificate.

Note that MITM doesn't mean that it must be a "malicious" attack as such.

You do not mention the internet source you're connected to when the problem occurs. Some connections, particular public WiFi such as in restaurants, on trains and busses, etc. will use seemingly MITM for presenting sign-on pages for their WiFi, or for the purpose of injecting ads into web pages.

The certificate you're getting is from an Icomera system. They supply systems for passenger WiFi on trains and busses. If you're using such WiFi, this is the source of your problems.

And yes, it is a terrible practice for Icomera and others to be building their systems like this.

Improve this answer
2
  • I've seen the certificates being swapped on public wifi networks previously but until I read your reply it hadn't dawned on me why this was happening in this case (as I did not visit or join anywhere like that). It must be when I'm walking home and a wifi enabled bus drives past. onboard.info then makes logical sense. This implementation is very poor security wise and there is actually no way to tell if it is a malicious attack or not.
    – sutra
    Apr 23, 2017 at 14:41
  • I agree, it is a poor solution security wise. You can set your phone so that it doesn't join those WiFi networks to avoid the problem in the future. Also please mark the question as answered as it seems this was the answer you were looking for.
    – jksoegaard
    Apr 23, 2017 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .